According to a recent LinkedIn post from Hacktron, the company is drawing attention to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 and now patched in recent PHP releases. The post notes that the flaws could allow unauthenticated remote code execution and are reportedly being broadly exploited, with activity traced back to 17 October.
The company’s LinkedIn post highlights that supported fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, while older branches down to PHP 5.4 are affected and PHP 8.1 and earlier no longer receive upstream updates. The post also advises operators to update all runtimes serving web traffic, restart PHP workers, and review logs for suspicious activity from at least 17 October, referencing a detailed external breakdown of mitigations and compromise indicators.
For investors, the post suggests Hacktron is positioning itself as a security-focused player by rapidly contextualizing emerging vulnerabilities and offering operational guidance. This may enhance its credibility with enterprise customers that rely on timely threat intelligence and incident-readiness support, potentially supporting retention and upsell opportunities in security consulting, monitoring, or related services.
At an industry level, the emphasis on widespread exploitation and end-of-support PHP branches underscores ongoing structural demand for application security and vulnerability management. Hacktron’s public commentary on such issues could strengthen its brand visibility among security-conscious organizations, though the post does not disclose any direct revenue impact, new products, or quantified business outcomes linked to this advisory activity.